GHSA-G2FM-8HR4-J82H

Vulnerability from github – Published: 2026-09-02 14:39 – Updated: 2026-09-02 14:39
VLAI
Summary
EasyAdmin custom-action dispatcher bypasses access_control on other routes
Details

Summary

EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() / MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event.

That swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user could reach a more restricted route by name.

Impact

Any application where access_control (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule.

Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] / denyAccessUnlessGranted() remain protected, because those checks are recomputed against the swapped-in controller.

Patches

Fixed in 4.29.16 and 5.5.1. Before dispatching a custom-action route, EasyAdmin now re-evaluates the target route's access_control rule and denies the request if the current user is not granted access.

Workarounds

Add controller-level authorization (#[IsGranted] / denyAccessUnlessGranted()) to any sensitive route, since controller-level checks are still enforced. Upgrading is the recommended fix.

Credits

Reported by @TungNGo02.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "easycorp/easyadmin-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.29.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "easycorp/easyadmin-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-81892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:39:11Z",
    "nvd_published_at": "2026-08-31T21:17:52Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nEasyAdmin serves all backend requests through a single dashboard route and, for custom actions (`Action::linkToRoute()` / `MenuItem::linkToRoute()`), swaps the executed controller based on the `routeName` query parameter on the `kernel.controller` event.\n\nThat swap happens **after** Symfony\u0027s security firewall has already evaluated `access_control` against the original dashboard URL, and the `routeName` value was not validated. As a result, a path-based `access_control` rule protecting the *target* route was never evaluated, so a low-privilege backend user could reach a more restricted route by name.\n\n## Impact\n\nAny application where `access_control` (or another path-based Symfony security rule) protects some routes more strictly than the dashboard URL used to reach EasyAdmin. An attacker who can reach a single EasyAdmin URL and knows a target route\u0027s **name** can execute that route\u0027s controller, bypassing the path-based rule.\n\nOnly **path-based** protections are bypassed. Routes whose controller enforces its own authorization with `#[IsGranted]` / `denyAccessUnlessGranted()` remain protected, because those checks are recomputed against the swapped-in controller.\n\n## Patches\n\nFixed in **4.29.16** and **5.5.1**. Before dispatching a custom-action route, EasyAdmin now re-evaluates the target route\u0027s `access_control` rule and denies the request if the current user is not granted access.\n\n## Workarounds\n\nAdd controller-level authorization (`#[IsGranted]` / `denyAccessUnlessGranted()`) to any sensitive route, since controller-level checks are still enforced. Upgrading is the recommended fix.\n\n## Credits\n\nReported by @TungNGo02.",
  "id": "GHSA-g2fm-8hr4-j82h",
  "modified": "2026-09-02T14:39:11Z",
  "published": "2026-09-02T14:39:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/security/advisories/GHSA-g2fm-8hr4-j82h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/commit/6228dfef598d81eeb0baa35625e50812f3c77699"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/EasyCorp/EasyAdminBundle"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v4.29.16"
    },
    {
      "type": "WEB",
      "url": "https://github.com/EasyCorp/EasyAdminBundle/releases/tag/v5.5.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/easycorp/easyadmin-bundle/CVE-2026-81892.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "EasyAdmin custom-action dispatcher bypasses access_control on other routes"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.